Description
gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libgd2 | 2.3.3-1 | — |
| Debian 13 | libgd2 | 2.3.3-1 | — |
| Debian 12 | libgd2 | 2.3.3-1 | — |
| Debian 11 | libgd2 | 2.3.0-2+deb11u1 | DLA-4411-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | libgd2 | 2.3.0-2ubuntu1 | — |
| Ubuntu 20.04 LTS | libgd2 | 2.2.5-5.2ubuntu2.1 | USN-5068-1 |
| Ubuntu 18.04 LTS | libgd2 | 2.2.5-4ubuntu0.5 | USN-5068-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | libgd2 | 2.1.1-4ubuntu0.16.04.12+esm1 | USN-5068-1 |
| Ubuntu Pro 14.04 LTS | libgd2 | 2.1.0-3ubuntu0.11+esm2 | USN-5068-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | gd | 2.3.0-r1 | — |
| Alpine v3.23 | gd | 2.3.0-r1 | — |
| Alpine v3.22 | gd | 2.3.0-r1 | — |
| Alpine v3.21 | gd | 2.3.0-r1 | — |
| Alpine v3.20 | gd | 2.3.0-r1 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | gd | 2.3.0-r1 | — |
| Alpine v3.18 | gd | 2.3.0-r1 | — |
| Alpine v3.17 | gd | 2.3.0-r1 | — |
| Alpine v3.16 | gd | 2.3.0-r1 | — |
| Alpine v3.15 | gd | 2.3.0-r1 | — |
| Alpine v3.14 | gd | 2.3.0-r1 | — |
| Alpine v3.13 | gd | 2.3.0-r1 | — |
| Alpine v3.12 | gd | 2.3.0-r1 | — |
| Alpine v3.11 | gd | 2.2.5-r4 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | gd +2 | 2.0.35-27.amzn2.0.1 | ALAS2-2023-2044 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | gd | 2.3.0-5 | — |
Advisories 5
- WID-SEC-2022-0432 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2022-0302 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Oct 11, 2026
- USN-5068-1 libgd2 vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- DLA-4411-1 libgd2 - security update Debian Security (DSA / DLA) · Dec 16, 2025
- ALAS2-2023-2044 Important: gd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 16, 2023